2026

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The fron

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business D

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Su

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attacke

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES all

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. A

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the rea

LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that des

MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a ga

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks

LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenti

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the

A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file

A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file b

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL fr

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates reg

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that re

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software

A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPosts

Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.

Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz A

Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / Stell

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Te

Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlid

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.